Keycloak
the only one with no commercial layer anywhere
every feature enterprises pay for elsewhere sits in the same apache 2.0 tree, with the entire operational burden as the price.
keycloak is the outlier in this ranking and deserves to be read as one. there is no pricing page because there is no hosted tier and nothing to buy. saml and oidc identity brokering, organizations, fine-grained admin permissions — all of it is in the apache 2.0 tree at github.com/keycloak/keycloak, with no enterprise directory and no second licence file. supertokens, ory, litellm and half this category run a commercial line through exactly these features.
the anchor is therefore infrastructure cost only. fifty thousand users, five hundred thousand, five million — the software does not meter, so what you pay is what the servers cost. against auth0's $3,500 a month at fifty thousand users, running keycloak on your own hardware is a rounding error, and that gap is why it persists in large organisations despite being the least fashionable option here.
the description above is ours, condensed from the ranking. pricing moves — check it on the vendor's own page before you rely on it.
- category
- auth providers
- pricing
- free — self-host only
- website
- keycloak.org
every feature enterprises pay for elsewhere sits in the same apache 2.0 tree, with the entire operational burden as the price.
we researched this category against vendors' own pricing pages and licence files. that is where this line comes from — not from the vendor, and not from anything they paid for.
more auth providers
Clerk
we checked this$25/mo (pro)$25 a month at fifty thousand users, with one sso connection included
WorkOS
we checked this$125/connection/mofree authentication to a million users, billed at the enterprise connection